Data ROI is a security governance problem, not just a cost issue

At a glance

What this is: This is an analysis of why data ROI in security pipelines should be judged by downstream value, not just reduced ingestion volume.

Why it matters: It matters because IAM, NHI, and broader security teams often lose context when they optimise for cost alone, which can weaken investigations, governance, and operational response.

By the numbers:

• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems.

👉 Read DataBahn's analysis of data ROI in modern security pipelines

Context

Data ROI in security is often treated as a storage or SIEM billing problem, but that framing is too narrow. When teams optimise for lower volume without measuring what the retained data enables, they can remove the context that makes detections, investigations, and compliance work effectively. For IAM practitioners, the same governance mistake appears when organisations reduce visibility into service accounts, tokens, and workload activity because those signals are noisy or expensive.

The deeper issue is that data value is created upstream, inside collection and enrichment pipelines, before the information reaches a downstream platform. That makes data handling a governance decision, not just an engineering one. In identity-heavy environments, the quality of telemetry affects secrets exposure detection, privilege analysis, and incident triage, so cost optimisation must be balanced against control effectiveness.

Key questions

Q: How should security teams decide which telemetry belongs in the SIEM?

A: Start with investigative value, not source count. High-fidelity SIEM retention should be reserved for telemetry that materially improves detection, forensics, or compliance. Lower-value data can be enriched first, routed to cheaper storage, or dropped if it adds cost without operational benefit. The decision should be policy-driven, measurable, and reviewed against detection outcomes.

Q: Why do identity and authentication logs matter so much in data ROI decisions?

A: They are often the records that explain whether an action was routine, risky, or abusive. Without authentication context, privilege detail, and workload identity signals, teams lose the evidence needed to validate detections and reconstruct incidents. That turns cost optimisation into visibility loss, which can be more expensive than the storage bill.

Q: What breaks when enrichment happens only after SIEM ingestion?

A: Three things usually break together: cost control, detection speed, and retention discipline. The organisation has already paid ingest pricing, analysts still need to add context manually, and noisy data competes with high-value telemetry in the same storage tier. Once the event is stored, the chance to make a smarter routing decision has passed.

Q: How do teams know whether data ROI is improving security outcomes?

A: Look for faster investigations, cleaner detections, lower reconciliation effort, and stronger audit readiness, not just lower spend. If the programme saves money while analysts lose context, ROI has improved on paper but declined operationally. The right signal is whether retained data consistently helps teams make better decisions.

Technical breakdown

Why volume reduction is a poor proxy for security value

Volume reduction tells you how much data was removed, not whether the remaining data is still useful. Security pipelines often cut authentication context, enriched DNS fields, endpoint detail, or application logs because they are noisy and expensive, yet those fields are what make correlation and investigation possible. In practice, the wrong optimisation target produces brittle detections, slower triage, and weaker root cause analysis. The technical mistake is assuming that less data automatically means better economics. Real efficiency depends on preserving the signal that supports decisions while discarding redundant or low-value telemetry.

Practical implication: classify telemetry by investigative and governance value before deciding what to drop.

How upstream enrichment changes pipeline economics

Upstream enrichment attaches context before routing or storage decisions are made. That context can include asset identity, threat intelligence, geolocation, or authentication metadata. Once telemetry is enriched in motion, the pipeline can distinguish between events worth full-fidelity retention and events suitable for lower-cost storage. This is why enrichment and filtering are not separate controls. They are one control loop, where context makes routing decisions defensible. Without enrichment, teams are filtering blind and often paying for either too much noise or too little evidence.

Practical implication: move enrichment earlier in the pipeline so cost decisions are based on context, not raw event counts.

Why trusted data is a control plane issue, not just an analytics issue

Trusted data is what allows downstream systems to act reliably during incidents, audits, or operational faults. When lineage, routing, and handling rules are enforced in the pipeline, the organisation can explain where data came from, how it changed, and why it was retained. That matters for security operations, but also for governance and resilience. In identity-rich environments, the same principle applies to access logs, identity events, and secret exposure signals. If the pipeline cannot preserve trust, the downstream platform cannot produce trustworthy decisions.

Practical implication: treat lineage, routing, and handling rules as control requirements, not just data engineering preferences.

Threat narrative

Attacker objective: The objective is not a single exploit outcome, but the exploitation of governance blind spots created when teams remove high-value telemetry and lose the evidence needed to detect or investigate identity abuse.

1. Entry begins when teams ingest high-volume telemetry without a value framework, causing them to trim the very fields that carry security context. Escalation follows when correlation logic loses authentication, endpoint, or application detail and analysts can no longer reconstruct the sequence of events accurately. Impact appears as slower investigations, weaker detection precision, and higher compliance and operational risk because the organisation has optimised for cost instead of evidence.
2. This pattern is especially damaging when identity and secret-related signals are removed, because access misuse becomes harder to distinguish from routine activity. The result is not a classic breach chain, but a governance failure chain where the control surface shrinks until the security team is operating with partial visibility.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Data ROI should be treated as a control effectiveness problem, not a finance metric. Cost per gigabyte is easy to measure, but it says very little about whether the retained data improves investigation quality, compliance confidence, or resilience. When teams optimise only for spend, they often remove the context that makes security analytics work. The right question is whether the pipeline preserves the evidence needed for action.

Telemetry enrichment is a governance control because it determines what the organisation can trust later. Once data is enriched, routed, and labelled in motion, it becomes part of the decision layer for SOC, GRC, and identity operations. That is why data handling should be governed with the same discipline as access policy. Practitioners should treat lineage and context as control inputs, not secondary metadata.

Secrets and identity signals are the first things teams should protect when optimising data pipelines. Authentication context, token activity, and workload identity events are often high volume, which makes them tempting to cut. Yet those signals are precisely what expose NHI misuse, privilege abuse, and suspicious access chains. The governance lesson is simple: if a dataset helps explain who or what touched a critical system, it has defensive value.

Contextual routing is emerging as the named concept behind modern Data ROI. It means deciding retention and delivery based on the value a record can create after enrichment, not on raw event size. That approach aligns with NIST SP 800-53 Rev 5 Security and Privacy Controls because it supports stronger auditability and more defensible access, retention, and monitoring decisions. Practitioners should evaluate whether their pipeline architecture can actually make those distinctions consistently.

Identity governance increasingly depends on data pipeline design. Security programmes that cannot preserve authenticated context, lineage, and handling detail will struggle to govern NHIs, secrets, and autonomous workloads effectively. The value framework is therefore not only about telemetry economics. It is also about whether the organisation can sustain reliable identity oversight at scale.

From our research:

• The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• That gap makes The 2026 Infrastructure Identity Survey a useful next read for teams evaluating where identity and access governance is slipping in practice.

What this signals

Contextual routing is becoming a practical control objective for security programmes. Once teams accept that telemetry value is created upstream, they have to govern enrichment, retention, and routing as part of the control stack. That shifts the conversation from cost compression to evidence preservation, which is much more relevant for identity-heavy operations and incident response.

For identity and NHI teams, the operational signal is clear: if your pipeline cannot preserve authenticated context and lineage, your governance model will eventually fail at scale. This is where the NIST SP 800-53 Rev 5 Security and Privacy Controls alignment matters, because auditability, access control, and monitoring depend on trustworthy data flows, not just well-written policies.

For practitioners

• Inventory telemetry by security value Map the logs, events, and metadata fields that support investigations, access review, secret detection, and compliance evidence. Rank them by the decisions they enable before you cut ingestion volume or change retention rules.
• Preserve identity and authentication context Keep the fields that explain who or what authenticated, from where, with what privilege, and through which workload or service account. Those records are often the first casualties of cost reduction, yet they are essential for tracing misuse.
• Move enrichment upstream Attach context before routing decisions so the pipeline can distinguish between high-value events and low-value noise. Use that enriched context to decide what goes to full-fidelity retention and what can be stored more cheaply.
• Govern routing as a security control Document why specific datasets are retained, summarised, or dropped, and tie those choices to detection, audit, and resilience requirements. In practice, routing rules should be reviewable in the same way as access policy.

Key takeaways

• Data ROI is not just a budget question. It is a control question about whether the organisation preserves the evidence needed for security and governance.
• Cutting telemetry by volume alone can remove the identity and authentication context that makes investigations, compliance, and detection work properly.
• Teams should measure ROI by decision quality, not just GB/day reduction, and use upstream enrichment to keep the right signals intact.

Key terms

• Data ROI: Data ROI is the value an organisation gets from collecting, enriching, retaining, and routing data, relative to the cost of handling it. In security programmes, it should be measured by improved investigation quality, governance confidence, and operational outcomes, not by storage savings alone.
• Telemetry enrichment: Telemetry enrichment is the process of attaching context such as asset identity, threat intelligence, or authentication detail to events before they are analysed or routed. Done well, it makes downstream decisions more accurate and defensible because the data carries meaning when it arrives.
• Contextual routing: Contextual routing is the practice of directing data to different storage or processing paths based on its security or operational value after enrichment. It allows organisations to preserve high-value records at full fidelity while reducing spend on low-value or routine telemetry.
• Evidence preservation: The process of collecting, protecting, and retaining logs, telemetry, and other artifacts so an incident can be reconstructed later. For compliance programmes, preservation is part of the response itself because it supports reporting, investigation, and accountability.

What's in the full article

DataBahn's full article covers the operational detail this post intentionally leaves for the source:

• How the pipeline distinguishes high-value telemetry from low-value noise before routing decisions are made
• Examples of enrichment stages that attach context in motion rather than after ingestion
• The specific operational scenarios where value-based routing improves investigations and compliance readiness
• How the platform frames cost reduction as a byproduct of controlled data handling rather than the goal

👉 The full DataBahn article covers the pipeline mechanics, enrichment logic, and value-based routing examples in more depth.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and identity lifecycle fundamentals. It helps practitioners connect identity control design to the broader security decisions their programmes depend on.